From 4efd74db51d75f22b9c65e5f1dbe5332854ffa0a Mon Sep 17 00:00:00 2001 From: Julien Grall Date: Tue, 20 Jun 2017 16:44:06 +0200 Subject: [PATCH] xen/arm: vgic: Sanitize target mask used to send SGI The current function vgic_to_sgi does not sanitize the target mask and may therefore get an invalid vCPU ID. This will result to an out of bound access of d->vcpu[...] as there is no check whether the vCPU ID is within the maximum supported by the guest. This was introduced by commit ea37fd2111 "xen/arm: split vgic driver into generic and vgic-v2 driver". Signed-off-by: Julien Grall Reviewed-by: Stefano Stabellini master commit: 6fb94196730f30929f1e617fd1d05daf55376664 master date: 2017-06-20 14:47:07 +0200 --- xen/arch/arm/vgic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c index a6835a806c..55efa7fef8 100644 --- a/xen/arch/arm/vgic.c +++ b/xen/arch/arm/vgic.c @@ -340,7 +340,8 @@ int vgic_to_sgi(struct vcpu *v, register_t sgir, enum gic_sgi_mode irqmode, int for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 ) { vcpuid = base + i; - if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) ) + if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL || + !is_vcpu_online(d->vcpu[vcpuid]) ) { gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \ target->list=%hx, wrong CPUTargetList \n",